AI Weekly Malaysia

The Go team published a post describing encoding/json/v2 and encoding/json/jsontext, now stable and generally available in Go 1.27 after last year's experimental release. The new API changes default behaviors that encoding/json got wrong: it rejects invalid UTF-8 rather than silently corrupting data (RFC 8259 requires valid UTF-8), rejects objects with duplicate member names instead of picking an arbitrary value, and addresses nil slices/maps marshaling to JSON null, which breaks consumers that disallow null where an array or object is expected. The post cites CVE-2017-12635 as a case where duplicate-name ambiguity was exploited.

Why: If you decode untrusted JSON with encoding/json today, duplicate keys are resolved arbitrarily and invalid UTF-8 passes through silently — v2 flips both to errors, so any pipeline that currently tolerates sloppy payloads may start failing at the decode step after you adopt it. Also check cross-language boundaries: Go marshaling a nil slice or map as null already trips strict consumers, and that is one of the things the new packages address. Since v2 lives at a new import path, you can migrate package by package rather than all at once.